Question

I am writing a basic authorization system and I am struggling with it a bit. There are two files involved – index.php and login.php. The login form is pretty simple (it’s inside index.php):

<fieldset class="right">
    <label for="email">Email

        <input id="email" name="email" type="text" value=""/>
    </label>
    <label for="password">Password
        <input id="password" name="password" type="password" />
        <a href="#" onclick="$('#password-box').toggle();" >Forgot your password?<span></span></a>
    </label>
    <div class="btn-login"><button type="submit" value="Login"></button></div>
</fieldset>
</form>

The login.php contents:

<?php
//  Include the launcher file.
require_once('globals.php');
require_once(CORE . 'launcher.php');

//  Collect the information sent to us.
$mail = (isset($_POST['email'])) ? $_POST['email'] : '';
$password = (isset($_POST['password'])) ? $_POST['password'] : '';

$LoginError = false;
    // AUTHORIZATION STUFF HERE
if ($LoginError) {
    header('Status: 200');
    header('X-Test: test');
    header('Location: index.php');
    exit();
}

As you can see, I’m sending a custom header to the script containing the form in case there was an error during signing in. In the index.php, I’m using headers_list(), but the header I’m sending is not present in the list.

What is causing that? I’ve tried with php_value "output_buffering" "0" in the .htaccess file, but no success.

UPDATE
After checking in Chrome, the header is being received by the browser, but is not available in PHP.

Thanks in advance.

Answer 1

The redirect is sent to and processed by the client which responds by navigating to the given Location: index.php. You should not expect that the custom header is provided by the browser when it is requesting index.php from the server.

CLIENT                                    SERVER
 |------- POST login.php ------------------>|
 |                                          |
 |<- 200, Location: index.php, X-Test:test -| (this is where you send the header)
 |                                          |
 |------- GET index.php ------------------->| (no header from client to server)